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On May 29, 2009, this Court issued a Supplemental Order in Docket No. PR/TT | 
that addressed several issues. Among other things, the May 29 Supplemental Order noted the 
government’s recent disclosure that the unminimized results of authorized queries of PR/TT 
metadata collected by the National Security Agency (NSA) pursuant to the Court’s order in 
Docket No. PR/TT and prior FISC orders had been shared with NSA 

analysts other than the limited number of analysts authorized to access such metadata. May 29 
Supplemental Order at 1-2. Such sharing had not previously been disclosed to the Court. Id at 
2. The May 29 Supplemental Order also noted the government’s disclosure of an inaccuracy 

regarding the number of PR/TT-derived reports described in paragraph 14 of the declaration 

•» 

attached as Exhibit A to the application in Docket No. PR/TT^^|. Id at 3. 

The Court directed the government to submit, within 20 days, a declaration correcting the 
inaccuracy regarding the number of reports and to provide a complete and “updated description 
of NSA’s dissemination practices.” May 29 Supplemental Order at 3-4. The Court further 
ordered that it would allow NSA, for a period of 20 days, to continue to share the unminimized 
results of authorized queries of the PR/TT metadata with NSA analysts other than the limited 
number of analysts authorized to access such metadata, but that such sharing was not to continue 
beyond the 20-day period unless the government first satisfied the Court, by written submission, 
that such sharing is necessary and appropriate on an ongoing basis. Id. at 4. 

On the United States filed the Government’s Response to the Court’s 

Supplemental Order Entered On Docket No. PR/TTj 

Response”), and the supporting Declaration °f |j[[[^H|HU Chief, Special Foreign 
Intelligence Surveillance Act Oversight and Processing, Oversight and Compliance, Signals 
Intelligence Directorate, NSA (‘‘^^^BMHDeclaration”). The government asserted in its 
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|filings that “the ability of PR/TT-cleared analysts to share unminimized query results 
with non-PR/TT-cleared analysts is critical to the success of the NSA’s counterterrorism 
mission.” HH Declaration at 8. The government explained that while “[ljess than ten 
percent of NSA’s analysts responsible for tracking and reporting foreign intelligence on 
counterterrorism matters generally may queiy the PR/TT metadata,” NSA’s “collective 
expertise” in the targeted foreign powers “resides in more than ^m^^intelligence 
analysts” assigned not only to “NSA’s Counterterrorism Analytic Enterprise,” but also to “other 
NSA organizations and product lines.” Id. at 7-8. Further, the government asserted that “[e]ach 
of the NSA’s Jjproduct lines has some role in protecting the homeland from terrorists.” Id. at 
8. Accordingly, the government has asked the Court to allow NSA to continue to share the 
results of authorized queries of the PR/TT metadata with analysts other than the limited number 



who are permitted to perform queries. See 



I Response at 9. 



On June 18, 2009, the United States submitted the Government’s Response to the Court’s 



Supplemental Order Entered on May 29, 2009, in Docket No. P! 



■ 



Requesting a 



Corrective Declaration (i 



[Response”), and the supporting Declaration of J 



Chief, Special Foreign Intelligence Surveillance Act Oversight and Processing, Oversight and 



Compliance, Signals Intelligence Directorate, NSA (“I 



[Declaration”). In those 



filings, the government explained that the ^B' e P°rts described in the declaration filed in 



support of the government’s application in Docket No. PR/' 



TI 



included only reports 



prepared by PR/TT-cleared analysts; however, that description did not include one additional 



report that was prepared by a non-PR/TT analyst. 



)eclaration at 2-3. 



Accordingly, the government asserted that “^■reports were produced and disseminated from 



inception of the PR/TT to I 



Id. at 3. 
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Unfortunately, the government’s responses to the Court’s May 29 Supplemental Order 
also raise two additional compliance issues, one which implicates not only the Court’s orders 
authorizing the collection of PR/TT metadata, but also its orders in the related bulk business 
records collection, which was last renewed by the Court in Docket No. BR 09-06. First, the 
government disclosed in its ^^^^ilings in Docket No. PR/TT jmjthat NSA has generally 
failed to adhere to the special dissemination restrictions originally proposed by the government, 
repeatedly relied upon by the Court in authorizing the collection of the PR/TT metadata, and 
incorporated into the Court’s orders^^^^^^^mjas binding on NSA. See( 

Response at 2. The Court’s current order, which is in pertinent part substantively identical to 



prior orders, provides that: 

The NSA shall treat information derived from queries of the metadata in 
accordance with United States Signals Intelligence Directiv^^UUSSID 18) 
(Attachment D to the application in docket number PR/TT ^B), and shall apply 
USSID 18 to minimize inform^joj^roncermn^U|Sj^^nM>Dtained from the 
pen registers and trap and Additionally, prior to 

disseminating any U.S. person information outside of the NSA, the Chief of 
Information Sharing Seivices in NSA’s Signals Intelligence Directorate shall 
determine that the information is related to counterterrorism information and is 
necessary to understand the counterterrorism information or to assess its 
importance. 

Docket No, PR/TT No.^^| Primary Order at 12.' In itsJU^ubmissions, however, the 
government disclosed that “the NSA has generally permitted the dissemination of U.S. person 
identities derived from the metadata acquired pursuant to the Court’s orders in this matter ... in 



accordance with [USSID 1 8] rather than specifically requiring that the narrower dissemination 



1 Before September^^H, the Court’s orders designated the “Chief of Customer 
Response” in the NSA’s Signals Intelligence Directorate as the official responsible for 
determining whether information proposed for (^^miination had the necessary connec^m^^ 
counterterrorism. See, e.g.. Docket No. PR/TT Order at 16; Docket No. PR/TT^^^|at 
10. 
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provision set forth in. the Court’s orders in this matter be strictly adhered to.” 




[Response 



at 2; see also 




declaration at 3-5. 



The Court understands the government’s disclosure to mean that NSA likely has 



disseminated U.S. person information derived from the PR/TT metadata outside NSA without a 
prior determination by the NSA official designated in the Court’s orders that the information is 
related to counterterrorism information and is necessary to understand the counterterrorism 



U.S. person information derived from the PR/TT metadata outside NSA after the designated 
official has made the required determination. Id. The government further stated that it is 
investigating the matter, id. at 2-3. 

Second, the government referred in its June 18 submissions to a dissemination-related 
problem that was first brought to the Court’s attention in a “preliminary notice of compliance 
incident filed with the Court on June 16, 2009.” June 1 8 ^^Declaration at 3 n. 1 . In the June 
16 notice - and in a separate notice filed contemporaneously in Docket No. BR 09-06 - the 
government informed the Court that the unminimized results of some queries of metadata 
collected in both matters had been “uploaded [by NSA] into a database to which other 
intelligence agencies . . . had access.” Preliminary Notice of Compliance Incident filed | 

| in Docket No. PR/TT Hj| at 2; Preliminary Notice of Compliance Incident filed June 1 6, 
2009, in Docket No. BR 09-06 at 2. Providing such access, the government explained, may have 
resulted in the dissemination of U.S. person information in violation of USSID 18 and the more 
restrictive restrictions on dissemination proposed by the government and adopted by the Court in 
its current and prior orders in both of the above-captioned matters. Preliminary Notice of 



information or to assess its importance. See 





,esponseat2. According to the 



government, on 



the Department of Justice instructed NSA only to disseminate 
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Compliance Incident * n Docket No. PR/TT at 2; Preliminary Notice of 

Compliance Incident filed June 16, 2009, in Docket No. BR 09-06 at 2. The government 
explained that, in the PR/TT matter, any such disseminations would have been in addition to the 
Hreports that are described by the government in the H^Jubmissions . 

Declaration at 3 n. 1 . The govermnent asserts that NSA terminated access by outside agencies to 
the database at issue on June 12, 2009, and that it is still investigating the matter. Preliminary 
Notice of Compliance Incident filed June 16, 2009, in Docket No. BR 09-06 at 2; Preliminary . 

at 2. 



Notice of Compliance Incident filed^^^^^^H in Docket No. PR/TT | 

' Based upon the information provided by the government in its recent submissions, the 
Court has concluded that NSA’s sharing of authorized queries of the PR/TT metadata with 
analysts other than the limited number authorized to access the metadata is not the principal 
concern presented. Indeed, according to the government, only one of thej^Jreports containing 
PR/TT metadata and disseminated outside NSA was prepared by a non-cleared analyst, The 
Court is gravely concerned, however, that NSA analysts, cleared and otherwise, have generally 
not adhered to the dissemination restrictions proposed by the government, repeatedly relied upon 
by the Court in authorizing the collection of the PR/TT metadata, and incorporated into the 



Court’s orders in this matter! 



as binding on NSA. Given the apparent 



widespread disregard of these restrictions, it seems clear that NSA’s Office of General Counsel 
has failed to satisfy its obligation to ensure that all analysts with access to information derived 
from the PR/TT metadata “receive appropriate training and guidance regarding the querying 
standard set out in paragraph c. above, as well as other procedures and restrictions regarding the 



retrieval, storage, and dissemination of such information .” Docket No. PR/' 



Order at 1 1 



(emphasis added). The Court is also seriously concerned regarding NSA’s placement of 
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unminimized metadata from both the above-captioned matters into databases accessible by 
outside agencies, which, as the government has acknowledged, violates not only the Court’s 
orders, but also NSA’s minimization and dissemination procedures set forth in USSID 18. 

Accordingly, it is hereby ORDERED that: 

1 . With regard to Docket No. PR/TT 
queries of the PR/TT metadata with NSA analysts other than the limited number of analysts who 
are authorized to access the metadata, provided, however, that any NSA analyst receiving such 
query results in any form has first received appropriate and adequate training and guidance 
regarding all rules and restrictions governing the use, storage, and dissemination of such 
information; 

2. With regard to Docket Nos. PR/TT|^|^nd BR 09-06, the government shall, by 
5:00 pirn, each Friday, commencing on July 3, 2009, 2 file with the Court a report listing each 
instance during the seven-day period ending the previous Friday in which NSA has shared, in any 
form, information obtained or derived from the PR/TT or BR metadata collections with anyone 
outside NSA, For each such instance, the government shall specify the date on which the 
information was shared, the recipient of the information, and the form in which the information 
was communicated (e.g„ written report, email, oral communication, etc.). For each such instance 
in which U.S. person information has been shared, the Chief of Information Sharing of NSA’s 
Signals Intelligence Directorate shall certify that such official determined, prior to dissemination, 
the information to be related to counterterrorism information and necessary to understand the 
counterterrorism information or to assess its importance; 

3. With regard to Docket Nos. PR/TT BR 09-06, the government shall 




NSA may share the results of authorized 



2 If Friday is a holiday, the report shall be submitted on the next business day. 
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include, in its submissions regarding the results of the end-to-end reviews, a full explanation of 
why the government has permitted the dissemination outside NSA of U.S. person information 
without regard to whether such dissemination complied with the clear and acknowledged 
requirements for sharing U.S. person information derived from the metadata collected pursuant 
to the Court’s orders. 



IT IS SO ORDERED this^J'^day of June, f “ * 




/ REGS1E 



REGGIE B. WALTON 
Judge, United States Foreign 
Intelligence Surveillance Court 



b(6) 




iputy Clerk 
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UNITED STATES 

FOREIGN INTELLIGENCE SURVEILLANCE COURT 
WASHINGTON, D.C. 




SUPPLEMENTAL ORDER 

On in the above-captioned docket, the Court ordered the National Security 

Agency (“NS A”) to cease using the “master list described in the 

government’s Preliminary Notice of Compliance Incident filed on within 20 days 

unless the government showed cause, in writing, why it is necessary and appropriate for the NSA 
to continue to use the list, HjjUsupplemental Order at 4. In addition, the Court ordered the 
government to explain, in writing, why any ongoing use of PR/TT metadata collected under the 
authority of orders in this matter (“PR/TT metadata”) in connection with deleting information 
associated with is consistent with this Court’s orders and otheiwise 

appropriate. ]d. 
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The Court has reviewed the Government’s Response to the Court’s Supplemental Order, 



filed on 



Chief, 



■’), and the Declaration ofg 
Special Foreign Intelligence Surveillance Act Oversight and Processing, Oversight and 
Compliance, Signals Intelligence Directorate, The National Security Agency, filed on the same 
date (“jjj^^^^^Declaration”). 

As the government has acknowledged, its practices with regard to the creation and use of 
defeat lists for mj^^selectors deviated, at least in part, from the procedures governing the 
handling of PR/TT metadata. It is important to note that the procedures at issue were devised by 
the government and incorporated into the Court’s orders as binding upon the NSA at the 
government’s suggestion. Had the government initially proposed procedures pennitting defeat 



list practices such as those described in the 



iResponse and thel 



)eclaration, 



the Court likely would have found them reasonable and would have incorporated such 
procedures in its orders. 

In any event, the Court finds that the continuation of the defeat list practices is reasonable 
and appropriate. Therefore, subject to further consideration following the submission of the 
government’s report on its end-to-end review, it is 

HEREBY ORDERED that the restrictions imposed by the Court in paragraph 3 of its 
Supplemental Order, are hereby lifted and, as the government requests, NSA is 
authorized to: 

o Continue to use the existing “master defeat list” for metadata reduction and management 



in its 



I contact-chaining repositories, including those repositories containing 
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PR/TT metadata and those containing non-PR/TT metadata; 



o Add to the “master defeat list” HHHHidentifiers discovered by NSA technical 
personnel through chain summary building and management processes, as described in 
paragraphs 6-8 of the^^^Uj^Declaration; and 
6 Add to the “master defeat list” I^BBdentifiers discovered by NSA analysts 
reviewing the results of authorized queries of the PR/TT metadata. 

This authorization was orally conveyed to the government 
IT IS SO ORDERED thisl 




¥ RE001E B. WALTON 
Juage, United States Foreign 
Intelligence Surveillance Court 



b(6) 




i t this document 



the orig'^ 01 1 
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